Information Management Assessment

Progress review

Department for Digital, Culture, Media and Sport

Reviewed October 2018

Published February 2019

Working with government to raise standards in information management Background

- The National Archives’ Information Management Assessment (IMA) programme was set up to review standards of information, records and knowledge management in government organisations.

- The Department for Digital, Culture, Media and Sport (DCMS) was first assessed in 2010. The National Archives undertook an IMA reassessment in March 2017. This progress review builds on feedback given to DCMS since the 2017 IMA reassessment. Arising from that reassessment were six recommendations. This report focuses on developments under the same headings and also references progress against the recommendations. Where progress has been uprated since the 2017 IMA, this has been highlighted with colour. The report concludes with areas for further development.

- Note – where evidence has been provided that is relevant to the recommendations in the 2017 reassessment report these are signposted with an R and the corresponding recommendation number, such as ‘R2’. The 2017 recommendations can be found in Annex A. Headline findings

- Implementation of the General Data Protection Regulations (GDPR) and Data Protect Act (DPA) 2018 in May 2018 was achieved without major issues and this was accomplished by considerable preparation, which included the formation of robust policy and an internal data protection working group. It is also pleasing to see continued engagement and leadership with arm’s length bodies following rollout. Consequently, DCMS have been now been graded as satisfactory in both measures under ‘The value of information’.

- There is good evidence of engagement with major IT suppliers to shape more effective software solutions. There are also comprehensive plans to develop IT systems to support the department which have been signed off by the executive board. The level of investment and aspiration is a step up and as a result, DCMS have now achieved a satisfactory grading in the digital continuity and IT change area under ‘Digital information and supporting technology’.

- The development and dynamic use of a detailed RAG risk register is a breakthrough for DCMS in managing information risk. There is clear ownership of issues and given that the framework for managing information management risk has been highlighted as a priority for the Better Information for Better Government programme, DCMS are aligned with cross-government thinking in this area. As a result, their rating has been upgraded from development area to good and this is a commendable leap.

- DCMS have evidenced good housekeeping and ownership of a large body of digital ODA records. They are embracing digital and are ready to pilot a large cloud-to-cloud transfer to The National Archives. They continue to work closely with partners to manage paper transfers. Accordingly, ‘Records, review and transfer’ has now has been a satisfactory grading. Summary of progress since the IMA

1 The value of information

| Section | IMA 2017 | Review 2018 | |----------------------------------------|-------------------|-------------| | Communicating and realising value | Satisfactory | Satisfactory| | Managing information as an asset | Development area | Satisfactory|

- Successful implementation of GDPR and continued support and leadership of arm’s length bodies. (R1)
- The Knowledge, Information Management & Information Technology (KIMIT) committee is still an effective governance group. Membership has been slimmed down slightly but attendance is generally good. KIMIT will still have ownership of the IT, information management and knowledge management strategies. (R2)
- Information Asset Owner (IAO) guidance and training has been updated. (R1)
- There has been good use of communication to promote the importance of information and records management including blogs, lunch and learn and going out and speaking to teams about this. (R2)
- There is evidence of annual compliance with updating the Information Asset Register (IAR) including a restatement of rationale and a link to good practice. (R1)

2 Digital information and supporting technology

| Performance rating | IMA 2017 | Review 2018 | |------------------------------------------|-------------------|-------------| | Supporting information through technology| Development area | Satisfactory| | Digital continuity and IT change | Development area | Satisfactory|

- There have been discussions directly with Google regarding enhancements to productivity software and underpinning information management systems - to make the user experience better (search capability) and add other functionality (automation). As a result, DCMS plan to upgrade to Google Enterprise in spring 2019, which will deliver these benefits. (R3)
- Monthly alignment meetings with the DCMS IT lead established. Records requirements now embedded in the IT Programme and an integral part of the new IT Strategy for 2018. (R3)
- Pending Google Enterprise, an accessible AODocs guidance document has been obtained and there are plans to publish this on the intranet. AODocs user feedback has been gathered for development and distribution of good practice. There is a comprehensive and Executive Board approved strategy to develop IT in the department.

3 Information risk, governance and oversight

| Performance rating | IMA 2017 | Review 2018 | |-------------------------------------|-------------------|-------------------| | Recognising information risk | Development area | Good practice | | Establishing control | Good practice | Good practice | | Providing guidance | Development area | Satisfactory | | Measuring impact | Development area | Development area |

- A detailed RAG risk register has been developed and implemented with clear ownership of issues. (R1)
- DCMS has met with other government departments to view good practice on defining information and records management risks. (R1)
- There has been work around identifying and logging information assets that contain personal data as part of GDPR implementation and the promotion of this through training, workshops and guidance. (R1)
- It is still the case that DCMS does not have an approved knowledge strategy despite endeavours to get senior buy-in. They do however, have a champion in place when this work is prioritised. (R2)
- Records management policy updated and approved by KIMIT. It includes a clear statement on what information management is and why it matters and really good to see the role of managers highlighted. (R2).
- DCMS have recruited a Head of Information and Governance/DRO to replace the previous DRO who left in summer 2017. (R4)
- A PowerPoint slide deck has been produced giving a high level view of the future of records and data and also an introduction to records management and GDPR and this has been incorporated into staff induction (R2)
- The DRO has established a series of briefings on the current suite of guidance on records and information management with the Knowledge Champions Network, looking to address previous gaps for users. (R3)

4 Records, review and transfer

| Performance rating | IMA 2017 | Review 2018 | |-------------------------------------|-------------------|-------------------| | Oversight of records and selection | Satisfactory | Satisfactory | | Implementing disposal decisions | Development area | Satisfactory | • DCMS have been using GDPR as a driver to promote good information and records management. (R2) • Arrangement with Ministry of Housing, Communities and Local Government to maintain effective transfer continues to run smoothly. (R5) • DCMS have a plan to implement an early transfer of ODA records and discussions with The National Archives about this have started. (R6) • There has been good housekeeping activity with a promoted ‘Records Clean up Week’ in the summer of 2018. Clear guidance was provided to the business. (R5)

Next Steps

The National Archives will continue to support DCMS in its work on information and records management through to the time of its next IMA. In the interim, we recommend that the following points are focussed on and built into departmental business planning:

• The Head of Information Governance at DCMS will publish a vision for information management over the next three years in spring 2019. This strategy paper will be accompanied by a SMART action plan to implement the design, expected to incorporate cultural shift and new tech. • The planned upgrade to Google Enterprise in spring 2019 has been considered and approved in light of the management challenges that digital records present. DCMS plan to exploit the opportunities for additional metadata, search capability and automation and this is very exciting. This migration of content will be accompanied by a thorough information tidy up. Annex A – 2017 recommendations

- Recommendation 1 - Department for Culture, Media and Sport (DCMS) should continue to improve its approach to information risk and information asset management.

- Recommendation 2 - DCMS should continue work to promote and maintain a good culture of information and records management across the department.

- Recommendation 3 DCMS needs to ensure that its technology environment supports legislative and business requirements for managing digital information and records and mitigate risks where this is not possible.

- Recommendation 4 - DCMS should continue to develop and support its KIM team governance and team structures and the service that it provides to the business.

- Recommendation 5 - DCMS needs to continue to maintain its progress in appraisal and selecting and transferring paper records in accordance with the Public Records Act and 20 Year Rule.

- Recommendation 6 - DCMS needs to develop a process for the appraisal, selection, transfer and sensitivity review of its digital information.